Any domain should be hosted somewhere on a DNS server called authoritative for that domain, and which 1
is also the final holder of the information for that domain. Any Internet user that asks for the IP 2
address of a domain will get it from its locally configured DNS server, which in turn find the 3
information from these authoritative DNS server. Note that it is recommended to have a second server to 4
serve as the second DNS server for that the domain. The second DNS server is authoritative for the 5
domain as well and is also known as a slave server, the first one being the primary or the master server. 6
To find out the authoritative servers for a domain run dig -t ns from name servers and the name 7
of the domain. 8
for example google.com 9
These are the authoritative DNS servers. 10
Let's try another domain, kali.org 11
Linux.com 12
or Cisco.com 13
These are the names of the DNS servers that host the domain and the fantasy of their IP address are on 14
dig with the -ta option, which is the default and the name of the server, like this dig - 15
ta and ns1.cisco.com 16
Sorry, ns1, and this is its IP address. 17
Or ns1.google dot com 18
This is the IP address of one authoritative DNS servers of Google.com; as we've already seen 19
Google.com has more DNS servers. 20
All are authoritative. 21
Let's get started with configuring the server we've just installed in the last lecture is being authoritative 22
for the crystalmind.academy domain. 23
The server is running, but you can check its status by executing: systemctl status bind9 24
And it's active and running. 25
If it’s not running you can start it with systemctl start bind9 and you can enable it to 26
start automatically at boot with systemctl enable bind9. 27
It's already enabled. 28
This is the master DNS server which holds the master copy of the zone file. The Zone file is the file 29
that contains information about the domain, such as subdomains, IP addresses and so on. 30
This information is called DNS Records, and any of the changes are made only on this server. To add a 31
new domain for which the server is authoritative 32
I'm editing the following file. 33
/etc/bind/named.conf.local 34
Note that the lines that are commented out begin with double forward-slashes. 35
So all these lines are commented out. And I am adding zone between double quotes the name of the domain, 36
crystalmind.academy 37
and a pair of curly braces and the semicolon after the closing curly brace; between the curly braces 38
I'm writing type master and file and the name of the zone file /etc/bind 39
db.crystalmined.academy 40
In this configuration, I create a new zone using the zone clause and I specify that this is the master 41
zone. 42
In other words, it means that this is the master of authoritative DNS server for the Domain. The zone 43
file is db.crystalmined.academy, where we'll add DNS records for the domain. 44
I'm saving and closing the file. 45
The next step is to create the zone file; instead of creating the zone file from scratch, I'll use a 46
zone template file which exists in /etc/bind. 47
So I'm copying /etc/bind 48
db.empty to a new file called db.crystalmined.academy 49
And I'm opening the file for editing. 50
Let's take a look at its contents, which may look a little bit cryptic for beginners. 51
The zone file contains three types of entries, comments which start with a semicolon, directives which 52
start with a dollar sign and resource records, a.k.a. DNS records. 53
There is only one directive in the file, 54
the ttl directive, which defines in sequence the default time to leave value for the zone. 55
This is the time a DNS record can be cached on other DNS servers. 56
Or when, an authoritative DNS server is asking these authoritative DNS server for a record, the server 57
will send the record and tell the other server to store it in its catch for this amount of seconds. 58
Let's talk about DNS records. 59
The first DNS record in the file is called the SOA or Start of Authority record. 60
This is the SOA. The second DNS record is called the NS or the name server record. It indicates which 61
are the authoritative DNS servers, 62
so the master and the slave for this domain. 63
There could be more NS records in a zone file.These two records, SOA and NS, are 64
mandatory for each domain. And I'll change the file like this. After 65
SOA 66
I'm writing the name of the master. 67
So ns1.crystalmind.academy. and a dot at the end; note that the domain names should end 68
in a dot, which means they are fully qualified domain names. 69
And the name of the authoritative DNS server is ns1.crystalmind.academy and the dot at 70
end. If there are more authoritative servers, write them on their own line. 71
ns2; the second one ns2.crystalmind.academy 72
I'm commenting out of this line because I don't have such a server for the moment. IN, which appears 73
on each line is the DNS class. 74
It stands for Internet. Though other DNS classes exist are rarely used. 75
The @ sign is the same as your base domain, so @ =crystalmind.academy 76
Now, let's add some other subdomains and records. 77
So this one is one subdomain, I am a a means address, and I'm writing the address of this subdomain. 78
This is in fact the IP address of this server. 79
This is the IP address. 80
These lines means that ns1.crystalmind.academy has this I.P. address. 81
And another subdomain mail IN MX (MX meansmail exchanger or mail server) a number of which represents 82
a priority and the name of the mail server mail.crystalmind.academy. 83
This is necessary only if you set up a male server for this domain. 84
The entire domain will have an IP address, so crystalmind.academy. IN A and the IP address. 85
Www is another subdomain 86
with the same IP address, then mail 87
and you can also have subdomains that have other IP addresses, for example, external, and it has 88
this IP address, 91 189. 89
88.181; I know this is not the easiest config file, I'll attach it as a resource to this lecture 90
and you can take it and just change the domain names and the corresponding IP addresses to your own. 91
Before restarting the server, I want to check if there are any syntax errors in the configuration files. 92
I'm running named-checkconf 93
to check named.conf.local 94
And named-check-zone, the name of the domaincrystalmind.academy and the path 95
to the zone file. 96
A silent output indicates no errors were found; if there are syntax errors in the zone file, you need 97
to fix them or the zone won't be loaded. And I'm 98
restarting bind: systemctl restart bind9; bind9 being the name of the service. 99
systemctl status bind9 100
will show us that the zone was loaded successfully. 101
By the way, the serial number of the zone file, which is 1 in this case, provides a way for other 102
servers, especially for the secondary servers, to verify that the contents of a particular zone file 103
are up to date. 104
If the serial number in a zone file hasn't changed since that zone was last loaded, the secondary servers 105
figure that they can ignore the file. 106
Always update the SOA serial number when you make changes to a zone file like this. 107
When you make any change increment this value. 108
And we see the new value for the sale number. I'm testing the DNS server by asking for some records 109
of the domain, so dig@ localhost 110
- t ns and the name of the domain. I want to see the authoritative DNS servers of the domain. 111
And this is the answer or dig@localhost -ta www.crystalmind.academy and it responded 112
back with the correct answer. 113
If you want to test the DNS from other machines on the Internet, wait around 24 hours after registering 114
the domain and setting the authoritative DNS servers at the register; this is required for the information 115
to update. 116
This is the DNS propagation time. 117
So from this machine, which is my local virtual machine, I'm running dig- t ns 118
crystalmind. academy. 119
And the information was updated successfully. 120
If I'm adding a new subdomain for the base domain, I'll see it on external machines. 121
So I'm adding another subdomain called public -dns IN A and the IP address of the public DNS server 122
of Google 8.8.8.8; I'm saving the file and restarting the DNS server. 123
I'm quering the new subdomain from another an external machine, so dig -ta public -dns 124
.crystalmind.academy and I have the right answer. 125
The answer was found by the DNS server configured on my system from the authoritative DNS server. We 126
now have a running the authoritative master DNS server for the domain. 127
In a production-ready environment, we still have to configure at least one secondary master server for the domain 128
and the reverse DNS resolution. 129
What we've done so far was setting up the primary master and the direct resolution, which means translating 130
domains to IP addresses. And the reverse resolution, which is optional, means translating IP addresses 131
to domain names. 132
Keep in mind that DNS is a very complex protocol with lots of details and you need some time and experience 133
to master it. Take it step by step and build your knowledge from the ground up.